Get hacked when visiting a site? - Java Drive By Download

This is a question we ask ourselves sometimes, and the answer takes two different forms .

Either we are paranoid and in this case when a pop-up window appears it is believed on words even if it is however false and gross (advertising).

Either we "  know each other  " and we know that a site is a page returned by a server that appears correctly thanks to the browser, which is theoretically secure to avoid access to local resources, for example. And so no risk unless this browser contains a flaw .

Well, it's almost true, but not quite. 

Because yes, it is possible to get hacked by visiting a site, flawless in the browser . But if a site contains a particular and vulnerable plugin.

This is for example the famous Java plugin . And the farm in question, which has no French equivalent, is called the Java Drive By Download that can be translated into exploitation conducted via Java.

This exploit, still unknown a few years ago, has now become very popular in the Black Hat environment, although this has resulted in massive security patches.

Of course, the Drive By Download does not only concern Java even if we will talk about it for example.

How does Java Drive By Download work?

It is possible to write Java applets to make a site more dynamic, to present an animation or more generally a game.

Only, the Java framework also allows you to download resources and run them directly. You see what I mean.

So just click on "  Run  " to directly run a malicious program on your own PC ...

How to protect yourself?

There is no secret, we must remain attentive and vigilant . The pre-run message tells you in the image above that the applet has a security risk .

Therefore run applets from trusted sites or in general that indicate a recognized publisher.

To be sure, run these plugins only in case of extreme necessity.

Also make all the updates that we offer.

In general, always think twice before clicking anywhere. Here, we can see it, we can be hacker by visiting a site, with a possible simple click on a "applet" java trapped.

Finally, be aware that anti-virus detect better and better these types of threats and will not hesitate to alert you. But being sensitized (e) will not hurt.